From lpsolit at gmail.com Thu Oct 17 11:33:28 2013 From: lpsolit at gmail.com (=?ISO-8859-1?Q?Fr=E9d=E9ric_Buclin?=) Date: Thu, 17 Oct 2013 13:33:28 +0200 Subject: Security Advisory for Bugzilla 4.4.1, 4.2.7 and 4.0.11 Message-ID: <525FCB08.8000105@gmail.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * A CSRF vulnerability in process_bug.cgi affecting Bugzilla 4.4 only can lead to a bug being edited without the user consent. * A CSRF vulnerability in attachment.cgi can lead to an attachment being edited without the user consent. * Several unfiltered parameters when editing flagtypes can lead to XSS. * Due to an incomplete fix for CVE-2012-4189, some incorrectly filtered field values in tabular reports can lead to XSS. All affected installations are encouraged to upgrade as soon as possible. Vulnerability Details ===================== Class: Cross-Site Request Forgery Versions: 4.4rc1 to 4.4 Fixed In: 4.4.1 Description: When a user submits changes to a bug right after another user did, a midair collision page is displayed to inform the user about changes recently made. This page contains a token which can be used to validate the changes if the user decides to submit his changes anyway. A regression in Bugzilla 4.4 caused this token to be recreated if a crafted URL was given, even when no midair collision page was going to be displayed, allowing an attacker to bypass the token check and abuse a user to commit changes on his behalf. References: https://bugzilla.mozilla.org/show_bug.cgi?id=911593 CVE Number: CVE-2013-1733 Class: Cross-Site Request Forgery Versions: 2.16rc1 to 4.0.10, 4.1.1 to 4.2.6, 4.3.1 to 4.4 Fixed In: 4.0.11, 4.2.7, 4.4.1 Description: When an attachment is edited, a token is generated to validate changes made by the user. Using a crafted URL, an attacker could force the token to be recreated, allowing him to bypass the token check and abuse a user to commit changes on his behalf. References: https://bugzilla.mozilla.org/show_bug.cgi?id=913904 CVE Number: CVE-2013-1734 Class: Cross-Site Scripting Versions: 2.17.1 to 4.0.10, 4.1.1 to 4.2.6, 4.3.1 to 4.4 Fixed In: 4.0.11, 4.2.7, 4.4.1 Description: Some parameters passed to editflagtypes.cgi were not correctly filtered in the HTML page, which could lead to XSS. References: https://bugzilla.mozilla.org/show_bug.cgi?id=924802 CVE Number: CVE-2013-1742 Class: Cross-Site Scripting Versions: 4.1.1 to 4.2.6, 4.3.1 to 4.4 Fixed In: 4.2.7, 4.4.1 Description: Due to an incomplete fix for CVE-2012-4189, some incorrectly filtered field values in tabular reports could lead to XSS. References: https://bugzilla.mozilla.org/show_bug.cgi?id=924932 CVE Number: CVE-2013-1743 Vulnerability Solutions ======================= The fixes for these issues are included in the 4.0.11, 4.2.7 and 4.4.1 releases. Upgrading to a release with the relevant fixes will protect your installation from possible exploits of these issues. If you are unable to upgrade but would like to patch just the individual security vulnerabilities, there are patches available for each issue at the "References" URL for each vulnerability. Full release downloads, patches to upgrade Bugzilla from previous versions, and CVS/bzr upgrade instructions are available at: http://www.bugzilla.org/download/ Credits ======= The Bugzilla team wish to thank the following people for their assistance in locating, advising us of, and assisting us to fix these issues: Mateusz Goik Fr?d?ric Buclin David Lawrence General information about the Bugzilla bug-tracking system can be found at: http://www.bugzilla.org/ Comments and follow-ups can be directed to the mozilla.support.bugzilla newsgroup or the support-bugzilla mailing list. http://www.bugzilla.org/support/ has directions for accessing these forums. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSX8sHAAoJEJZXZhv5X1hqgboQAJJXpN/n7Act9Wlo8xpNtAJ6 W/v2BYJI3S3+s1cfFOVrDdjJdQwPNBadaTeN3LUVB8PzfdAuaofVeNF2FqmK7RSV vEyUFS3GoLO4jlQzdwjtdFcI0zcoX7Y0l/RTuEGolFZIVAy3ROYgqEfix9lzsWFP WavdIODPWaxvTNon3Rl2nuxtbWXZEIdBBSKqRjU1kdsr/fZMFi5V0xt8EMQAmcNn P7r5JHbBh4T21FyYPpJ+hMU8tOy1JLtQayqFWsaC2/8h8RZGzpA465HkqcsI0QVd Yw5jDpb1zoVKFNV0ZxSmlM54CilzcXODESidVC0iLxzpc7wsIEPxEVYXQuxB5qkh phAUh5rOenHDYwZdbFQf8/Fmxc2NUUVpzkqlRxbFiqrvgGXS920iD3wtHyr0FCy5 KlaxXaB6wNKHpc+ARWPnsUWAoctJHyZ0TzXKdp8xL96zzFV2b2cS08TK94pOog7l d9gN3vfURZfJ8XMSsw13Un1X0R3IiGhBEp49lbAB0NfPL7PDRNJe7A6JPMIveMK8 1K3Sm7gWuOpRgkNzmRzCcmivt0X0t4+wGFYj3lN9+rNiVrdNpDvdFkmkrCjqzTRf wsvB5FbPCauEgkiZ1Oa4HuMaoEptAD9E0xV9bzmCyXzo7q43tyrUMVBDBsSFX1Xk SPcXg8EMItpwbHCHzAkO =kej7 -----END PGP SIGNATURE----- From dkl at mozilla.com Thu Oct 17 14:55:38 2013 From: dkl at mozilla.com (David Lawrence) Date: Thu, 17 Oct 2013 10:55:38 -0400 Subject: [ANN] Release of Bugzilla 4.5.1, 4.4.1, 4.2.7, and 4.0.11 Message-ID: <525FFA6A.4090607@mozilla.com> Today we are releasing 4.4.1, 4.2.7, 4.0.11, and the unstable development snapshot 4.5.1. Initially, we released new tarballs and diffs for these releases to the download site but found a new bug shortly after. New tarballs and diffs have been uploaded to the site which we recommend everyone update to if you downloaded the first version. To make sure you have the fixed version, md5sum values are provided further down in the announcement. All of today's releases contain security fixes. We recommend all Bugzilla administrators to read the Security Advisory linked below. Bugzilla 4.4.1 is our latest stable release. It contains various useful bug fixes, performance improvements and security fixes for the 4.4 branch. Bugzilla 4.2.7 and 4.0.11 are security updates for the 4.2 branch and the 4.0 branch, respectively. Note that 4.5.1 is an unstable development release and should not be used in production environments. We are not yet feature-frozen at this time so the features you see in 4.5.1 might not accurately represent the behavior that 5.0 will have. Note that when Bugzilla 5.0 is released, the Bugzilla 4.0.x series will reach end of life. If you are using that series, we encourage you to upgrade to 4.4.1 now. Download -------- Bugzilla is available at: http://www.bugzilla.org/download/ MD5SUMS 53d0bffc3055f7d5af1c754f177de4ad bugzilla-4.5.1.tar.gz fd9d6dcc85bb359536be52e34ad20dfd bugzilla-4.4.1.tar.gz ebf0a75d1037f09994660d3958fc66fb bugzilla-4.2.7.tar.gz 48402a4a105de3f00962dca244cd7569 bugzilla-4.0.11.tar.gz Security Advisory ----------------- There is a security advisory describing the security issues fixed in these releases, at: http://www.bugzilla.org/security/4.0.10/ Release Notes & Changes ----------------------- Before installing or upgrading, you should read the Release Notes for the new version of Bugzilla: 4.4.1: http://www.bugzilla.org/releases/4.4.1/release-notes.html 4.2.7: http://www.bugzilla.org/releases/4.2.7/release-notes.html 4.0.11: http://www.bugzilla.org/releases/4.0.11/release-notes.html It is VERY IMPORTANT to read the Release Notes if you are upgrading from one major version to another (like 3.6.x to 4.4.x). To see a list of all changes between your version of Bugzilla and the current version of Bugzilla, you can use the chart at: http://www.bugzilla.org/status/changes.html The Bugzilla Update ------------------- You can see the latest updates from the Bugzilla Project and the status of Bugzilla development on The Bugzilla Update: http://bugzillaupdate.wordpress.com/ Also, you can follow the Bugzilla Project on Twitter for frequent updates on new features being developed in Bugzilla, our current release plans, and much more: http://twitter.com/#!/bugzilla Report Bugs ----------- If you find a bug in Bugzilla, please report it! Instructions are at this URL: http://www.bugzilla.org/developers/reporting_bugs.html Support ------- You can ask questions for free on the mailing lists (or in IRC) about Bugzilla, or you can hire a paid consultant to help you out: Free Support: http://www.bugzilla.org/support/ Paid Support: http://www.bugzilla.org/support/consulting.html About Bugzilla -------------- Bugzilla is a "Defect Tracking System" or "Bug-Tracking System." Defect Tracking Systems allow individuals or groups of developers to keep track of outstanding bugs in their product effectively. Most commercial defect-tracking software vendors charge enormous licensing fees. Despite being "free", Bugzilla has many features its expensive counterparts lack. Consequently, Bugzilla has quickly become a favorite of thousands of organizations across the globe, and is widely regarded as one of the top defect-tracking systems available. See http://www.bugzilla.org/about/ for more details. - David Lawrence Release Manager, Bugzilla Project